Privacy Policy
Draft — not yet in force1. Who is responsible for the data
| Organisation | Role | Responsible for |
|---|---|---|
| Your business's bank | Controller | The records of your business, its administrators, tills and payments held in the ZAM Service, which Techween hosts and operates for the bank |
| Techween | Publisher of the App; processor for the bank | Publishing the App, and running the ZAM Service on the bank's instructions under a written data processing agreement and Kuwaiti banking secrecy. Techween does not use the data for any purpose of its own |
2. What data the App handles
2.1 About you, the administrator
Your email address, your administrator level, whether your sign-in is active and when your account was created. The one-time codes sent to your email are checked by the ZAM Service and not kept by the App.
2.2 Stored on your phone
In the phone's secure storage (iOS Keychain or Android encrypted storage): the address of the ZAM Service, your session token and when it expires, your administrator record, and your business's details as last shown (name, address, contact email and phone, logo, colours, limits and bank). Signing out removes the session and your record; the business details stay until you change service address or remove the App.
2.3 Sent to the ZAM Service
Your email address when you ask for a code, and the code. With the code, your phone's operating system and version, the App's version, and a report of the phone's integrity (whether it is rooted, jailbroken, an emulator, under a debugger, hooked or a modified copy of the App). Then what you do in the App: tills you add or edit, link codes and checkout keys you create, the void PIN you set, voids and their reasons, searches, and the email addresses and levels of administrators you add.
2.4 Shown to you
Your business's takings, payments and balances, including each customer's display name supplied by their bank, authorization codes and references; your tills and their linked devices (name, model summary, when last seen); and your business's other administrators (email and level).
2.5 What the App does not collect
No location, contacts, photos, camera or microphone, advertising identifier, analytics, crash reports or push notifications. The App asks for no phone permissions.
3. Why the data is processed
| Purpose | Data | Basis |
|---|---|---|
| Sign you in and keep you signed in | Email, code, session, phone details | The Merchant Agreement and these Terms |
| Let you administer your business's tills and payments | Everything in Section 2.3 and 2.4 | The Merchant Agreement and these Terms |
| Security and fraud prevention | Integrity report, request and audit logs | The bank's legitimate interest and its obligations under Central Bank of Kuwait rules |
| Record keeping, reconciliation and disputes | Payment and audit records | The bank's legal obligations |
4. Who receives the data
- The ZAM Service, hosted by Techween for your business's bank, and your business's bank.
- The email provider that delivers sign-in codes to your address.
- Regulators and authorities where the laws of Kuwait require.
- Anyone you share with: when you share a link code, checkout key or payment from the App, it goes to the app and people you choose.
Nobody sells this data, and it is not used for advertising.
5. Where it is kept
The ZAM Service is hosted by Techween for the bank in [PLACEHOLDER — Google Cloud, Doha, Qatar, subject to the Central Bank of Kuwait's no-objection / Kuwait], encrypted, with access limited to named Techween staff under the bank's audit.
6. How long it is kept
| Data | Retention |
|---|---|
| Session on your phone | Until you sign out, it expires, or you remove the App |
| Your administrator record | While you are an administrator, then with the audit records |
| Payment records, audit and request logs | At least ten (10) years, as Central Bank of Kuwait record-keeping rules require |
7. How it is protected
Every connection uses TLS 1.2 or higher. Sign-in needs a fresh code sent to your email each time, the session is tied to the service that issued it, and the App refuses to run on a compromised phone. Checkout keys and the void PIN cannot be read back after they are set. Staff access to the ZAM Service is individually identified and logged.
8. Your rights
Subject to the laws of Kuwait, you may ask to access or correct your data, or object to its use. Requests about your business's records go to your business's bank, which holds them; requests about the App go to Techween at the address below. You may complain to the Central Bank of Kuwait or to the Communication and Information Technology Regulatory Authority (CITRA).
9. Changes to this Policy
We will publish changes in the App and on techween.net, and ask again in the App before a change that matters takes effect.
10. Contact
Techween: support@techween.net · Data protection contact: [PLACEHOLDER] · Postal address: [PLACEHOLDER]